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EXECUTIVE SUMMARY 



BACKGROUND 

The Freedom of Information Act (FOIA) is a Federal law that provides any 
person the right to submit a written request for access to records or 
information maintained by the Federal Government. The Nuclear 
Regulatory Commission's (NRC) FOIA program is managed by the FOIA, 
Privacy, and Information Collections Branch (referred to in this report as 
the FOIA office) within the Office of Information Services, Customer 
Service Division. 

The FOIA process begins when the agency (1) receives - via mail, 
facsimile, or Internet - an incoming FOIA request, (2) assigns it a number, 
and (3) determines which NRC offices need to review their records to 
identify whether they have information pertinent to the request and sends 
a request to those offices. FOIA coordinators in responsive offices 
provide an estimate of the search, review, and duplication effort required 
to produce any documents identified as within the scope of the request. 

The FOIA office then estimates the associated processing fees (for which 
the requester may be responsible), advises the requester as to the 
amount due, and assigns the request to the appropriate offices to identify 
and provide to the FOIA office all relevant documents from their office 
within an assigned timeframe. To facilitate appropriate disclosure of 
records, the FOIA coordinators consult as needed with agency staff in the 
responding offices and/or the Office of the General Counsel to prepare a 
response. The response is reviewed and signed by the FOIA officer, and 
sent to the requester. 

OBJECTIVE 

The audit objective was to determine whether the FOIA process is efficient 
and complies with the current laws. 

RESULTS IN BRIEF 

NRC generally responds to FOIA requests in accordance with Federal 
requirements. The agency meets the timeliness requirements for simple 
FOIA requests and adheres to the vast majority of FOIA regulations; 
however, opportunities exist to improve program efficiency and increase 
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Federal compliance by (A) fully using technology and enhancing training 
requirements and (B) adhering to review and approval regulations. 

Operational Efficiency Could Be Improved 

The efficiency of NRC's FOIA program can be improved by fully using 
available technology and enhancing agency training. Federal agencies 
should have the necessary tools and training to respond promptly and 
efficiently to FOIA requests. However, NRC management has not 
implemented effective internal controls. As a result, FOIA processing 
costs are high and the timeliness requirements are not consistently met. 

Management Level Reviews Are Inconsistent 

NRC is not in compliance with FOIA regulations as initial disclosure 
reviews of FOIA records are done at inconsistent management levels. 
Federal regulations state that, during the initial disclosure review, the head 
of the responsible office must review agency records to determine whether 
the agency records are exempt from disclosure; however, there is no 
enforcement of this policy and there is no method to track these reviews. 
Additionally, NRC's internal guidance differs from the Code of Federal 
Regulations. This may result in (A) a reduced number of discretionary 
releases or (B) the inadvertent release of sensitive information. 

RECOMMENDATIONS 

This report makes nine recommendations to improve the efficiency of 
NRC's FOIA process. 

AGENCY COMMENTS 

An exit conference was held with the agency on June 1 1 , 2014. Prior to 
this meeting, after reviewing a discussion draft, agency management 
provided supplemental information that has been incorporated into this 
report, as appropriate. As a result, agency management stated their 
general agreement with the findings and recommendations in this report 
and opted not to provide formal comments for inclusion in this report. 
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ABBREVIATIONS AND ACRONYMS 



ADAMS 


Agencywide Documents Access and Management System 


CFR 


Code of Federal Regulations 


DOJ 


The Department of Justice's Office of Information Policy 


FOIA 


The Freedom of Information Act 


NRC 


Nuclear Regulatory Commission 


OIG 


Office of the Inspector General 


OIS 


Office of Information Services 


TABS 


Transforming Assets into Business Solutions 
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I. BACKGROUND 



The Freedom of Information Act (FOIA) 1 is a Federal law that provides any 
person the right to submit a written request for access to records or 
information maintained by the Federal Government. In response to such 
written requests, Federal agencies must disclose the requested records, 
unless they are protected from release under one of the nine FOIA 
statutory exemptions. 2 FOIA mandates that all agencies shall readily 
promulgate information, agency rules, opinions, orders, records, and 
proceedings to the public. 

Executive Memoranda 

In 2009, President Barack Obama and Attorney General Eric Holder 
issued memoranda on the FOIA. These statements of FOIA policy 
emphasized that the FOIA "should be administered with a clear 
presumption: in the face of doubt, openness prevails." The President also 
directed agencies to "take affirmative steps to make information public" 
and not to "wait for specific requests from the public." The Attorney 
General's FOIA Guidelines stressed the need for agencies to: 

• Have efficient and effective systems in place for responding to 
requests. 

• Increase proactive disclosures. 

• Improve the use of technology. 

• Reduce backlogs of pending FOIA requests and appeals. 

• Improve timeliness in responding to requests. 

Federal FOIA Oversight 

The Department of Justice's Office of Information Policy (hereinafter 
referred to as DOJ) oversees agencies' FOIA implementation. 
Additionally, DOJ also issues FOIA policy guidance, conducts FOIA- 
related training programs to Government staff, and is responsible for 
encouraging compliance. 



1 5 U.S.C. § 552, As Amended 

2 See Appendix B for a listing of the nine statutory exemptions. 
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NRC Guidance 

The Nuclear Regulatory Commission's (NRC) FOIA requirements are 
conveyed in the Code of Federal Regulations (CFR) under Title 10, Part 9, 
Subpart A, "Freedom of Information Act Regulations." NRC Management 
Directive and Handbook 3.1, "Freedom of Information Act," provides 
guidance on NRC's FOIA policy and implementation of the FOIA process. 3 
NRC also maintains an internal and public Web site with FOIA information 
available to staff. 

FOIA Process 

NRC's FOIA program is managed by the FOIA, Privacy, and Information 
Collections Branch (referred to in this report as the FOIA office 4 ) within the 
Office of Information Services (OIS), Customer Service Division. The 
FOIA process begins when the agency (1) receives - via mail, facsimile, 
or Internet - an incoming FOIA request, (2) assigns it a number, and (3) 
determines which NRC offices need to review their records to identify 
whether they have information pertinent to the request and sends a 
request to those offices. FOIA coordinators 5 in responsive offices provide 
an estimate of the search, review, and duplication effort required to 
produce any documents identified as within the scope of the request. 

The FOIA office then estimates the associated processing fees (for which 
the requester may be responsible), advises the requester as to the 
amount due, and assigns the request to the appropriate offices to identify 
and provide to the FOIA office all relevant documents from their office 
within an assigned timeframe. To facilitate appropriate disclosure of 
records, the FOIA coordinators consult as needed with agency staff in the 
responding offices and/or the Office of the General Counsel to prepare a 
response. The response is reviewed and signed by the FOIA officer, and 



3 Management Directive 3.1 was last revised on June 8, 201 1 . 

4 The FOIA office consists of a branch chief, FOIA officer, administrative assistant, and Government 
information specialists (also known as FOIA specialists). FOIA specialists consist of NRC employees and 
contractors. 

5 Each NRC office has a FOIA coordinator who acts as a central point of contact for his/her respective 
office. The coordinator serves as a liaison between the FOIA office and the subject matter experts who 
are responsible for collecting and redacting, as appropriate, the FOIA records within the program offices. 
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sent to the requester. See Figure 1 for a simplified FOIA process 
flowchart. 



Figure 1: FOIA Process Flowchart 



Requester Submits Request 



Intake Processing 

• Receive request 

• Assign tracking number 

• Determine if simple or complex 

• Acknowledge request 



Send Response to Requester 



Approve Release of Records 

Review and approve records for 
release 



Generate response letter 



Search for Records 

• Initiate search in responsible 
office(s) 

• Review responsive documents 



I 



Process Records 

Determine applicable exemptions 
Conduct foreseeable harm 
analysis 

Redact and mark records 



Source: Office of the Inspector General (OIG) 



Agencies have a statutory responsibility to make a determination on FOIA 
requests within 20 working days. This type of FOIA request is known as a 
"simple" request. The FOIA also gives agencies the right to extend that 
time by 10 working days when a given request requires additional search 
time or consideration. These types of requests are called "complex" 
requests. This may apply when (1 ) NRC needs to assemble responsive 
records from its regional offices; (2) the request involves a "voluminous" 
amount of records that must be located, compiled, and reviewed; or (3) 
NRC must consult with another NRC office or Federal agency that may 
have originated the information or have a substantial interest in the 
information. 



Japan FOIA Team 



Also working on FOIA responses since June of 201 1 is a temporary 
"Japan team." The Japan team was created by the Office of Nuclear 
Security and Incident Response and OIS for the sole purpose of 
responding to the numerous requests for agency records related to the 
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March 2011 Fukushima Daiichi nuclear disaster. 6 Established shortly after 
the Fukushima incident, the Japan team has posted almost 260,000 
pages of responsive records to the agency's Web site, and has completed 
its review of the last responsive documents. The team anticipates closing 
out all the requests by the end of June 2014. Once the responses are 
completed, the members of the team will either be reassigned or released. 
For these reasons, the Japan team was excluded from the scope of this 
audit. 

FOIA Centralization 

As part of the NRC Transforming Assets into Business Solutions (TABS) 7 
initiative, NRC intends to streamline the FOIA process by eliminating the 
current FOIA coordinator positions within the program offices. 8 
Centralization will move most program office FOIA-related administrative 
functions to the FOIA branch within OIS. Currently, the majority of 
program offices have a FOIA coordinator who is an employee of that office 
and fulfills the coordinator responsibilities as a collateral duty. 
Centralization will transfer these responsibilities to the FOIA office, which 
will add four additional staff to enable it to handle the added workload. 
Centralization is expected to be completed in FY 2015. 



6 On March 1 1 , 201 1 , a 9.0-magnitude earthquake and an estimated 45-foot-high tsunami struck Japan 
off the Honshu Island coast at the Fukushima Daiichi nuclear power plant, causing a hydrogen explosion 
and release of radioactive material. Radioactive contamination spread over a large area of Japan, 
requiring the relocation of tens of thousands of people. 

7 TABS is an agencywide initiative to reduce the duplication of efforts in corporate support and office 
support areas such as human resources, information technology, financial management, and contract 
management. The goal of TABS is to reduce agency overhead by finding solutions for the most effective 
and efficient delivery of business support services. 

8 The Office of Enforcement, Office of the Secretary, Office of Investigations, regional offices, and OIG 
are currently excluded from centralization because of functional and logistical impediments. 
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II. OBJECTIVE 



The audit objective was to determine whether the FOIA process is efficient 
and complies with the current laws. Report Appendix A contains 
information on the audit scope and methodology. 

III. FINDINGS 



NRC generally responds to FOIA requests in accordance with Federal 
requirements. The agency meets the timeliness requirements for simple 
FOIA requests and adheres to the vast majority of FOIA regulations; 
however, opportunities exist to improve program efficiency and increase 
federal compliance by (A) fully using technology and enhancing training 
requirements and (B) adhering to review and approval regulations. 

A. Operational Efficiency Could Be Improved 

The efficiency of NRC's FOIA program can be improved by fully using 
available technology and enhancing agency training. Federal agencies 
should have the necessary tools and training to respond promptly and 
efficiently to FOIA requests. However, NRC management has not 
implemented effective internal controls. As a result, FOIA processing 
costs are high and the timeliness requirements are not consistently met. 

Processes Should Be Efficient 

Federal agencies, to include NRC, should have the necessary tools and 
training to respond promptly and efficiently to FOIA requests. FOIA 
professionals deserve the full support of the agency's Chief FOIA Officer 
to ensure that they have the tools they need to respond promptly and 
efficiently to FOIA requests. Additionally, all agencies should use modern 
technology to inform citizens about what is known and done by their 
Government. DOJ guidance and best practices suggest that agencies 
should actively explore using technology to process FOIA requests. 
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The Open Government National Action Plan for the United States of 
America 9 recommends that all agency employees, not just FOIA 
personnel, have FOIA training in order to efficiently and effectively 
respond to FOIA requests. DOJ guidance and best practices maintains 
that each agency should require that its personnel, both FOIA and non- 
FOIA, attend training to understand FOIA guidelines on transparency. 

Processes Could Be More Efficient 

Use of Technology Could Be Expanded 

NRC does not use technology to the fullest extent possible in processing 
its FOIA requests. The individuals in the program office responsible for 
searching for the requested information (also known as the subject matter 
experts) must provide the records to the FOIA office which, in turn, 
supplies the records to the requester. In many of these instances, when 
the subject matter experts locate the requested records, they must first 
redact any information that falls under one of the statutory exemptions. 10 
For example, any records containing personally identifiable information or 
classified information would either be completely withheld or provided to 
the requester with redactions protecting the sensitive information. 

The entire redaction process is tedious and paper intensive. If subject 
matter experts need to redact any information, they must first make sure 
they print the responsive records as this process is currently done 
manually. They must then manually place "brackets" around the 
information they wish to redact before forwarding the records to the FOIA 
office. The FOIA office staff must then scan the hardcopies into their 
computers before completing the actual redaction using specialized 
software. For a large FOIA request, there could be hundreds or 
thousands of pages to redact. 



9 This plan, created by the Obama administration in 201 1 and updated in 201 3, lists a set of commitments 
and actions that have or will be taken by the Federal Government to create a more efficient, effective, and 
accountable Government. 

10 The statutory exemptions can be found in Appendix B. Additionally, in order to withhold information in 
agency records, a foreseeable harm statement must be provided for Exemptions 2 and 5. 
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Several staff expressed frustration with this manual process. For 
example: 

• The previous NRC FOIA officer and two FOIA coordinators stated 
that reviewing FOIA records is "very time-consuming." 

• A contractor hired to process FOIA requests observed that the NRC 
FOIA process was still very "paper-laden" and opined that it should 
move to the electronic world. 

• A FOIA coordinator from a regional office said that he wanted 
electronic processing because his office has so much paperwork 
even though many of their records are already electronic; this is 
due to the need to print their FOIA records for NRC headquarters. 

• A FOIA staffer said that rather than dealing with paper and 
microfilm, storing and processing everything electronically would be 
the most efficient way to go. 

A senior manager from DOJ stated that electronic processing really cuts 
down the manual processing time. The manager added that technology is 
the primary way to improve timeliness and that agencies need to go in the 
direction of processing FOIA requests electronically. 

FOIAXpress 

To process FOIA requests more efficiently, the FOIA office uses a 
commercial software application called FOIAXpress. FOIAXpress is a tool 
used for automating the FOIA request process by managing the entire 
lifecycle of a FOIA request, from initial request to final delivery of 
documents. The purpose of the software is to automate the FOIA request 
process in order to save Federal agencies time and money, while also 
ensuring compliance with DOJ requirements. However, as of March 28, 
2014, NRC's FOIA office was using a version of FOIAXpress that was 
more than 2 years old (Version 7); the most current version is Version 9. 
This is significant for the following reasons: 
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Working with outdated software decreases efficiency and increases the 
likelihood of errors in processing FOIA requests. 

1 . Version 9 of FOIAXpress introduced a feature called Advanced 
Document Review. Advanced Document Review is a 
deduplication 11 technology that can significantly reduce email and 
document sets by filtering out duplicate and non-responsive emails 
and documents. This, in theory, saves valuable time and effort in 
redacting the FOIA records. 

According to the DOJ Open Government Plan 2.0, one of the most 
common delays in the processing of FOIA requests across the 
Government is the time spent by FOIA personnel searching for, 
deduplicating, and conducting initial responsiveness reviews on records. 
Much of this is done by hand or by using commercial software with limited 
capabilities for advanced document review and redaction. These steps 
must take place before a FOIA professional can even begin to review 
records for the application of FOIA exemptions and for ultimate release to 
FOIA requesters. 

2. As a free add-on feature to Version 9 of FOIAXpress, there is an 
additional tool called Public Access Link. Public Access Link is a 
public-facing Web portal that provides electronic communication 
between requesters and Federal agencies. Public Access Link 
allows requesters to electronically submit FOIA requests, 
correspond with NRC, check the status of a request, receive their 
final documents, and access a number of dashboard presentations 
on NRC's overall FOIA status - such as the number of open 
requests or number of requests received. 

To ensure that additional costs were not the primary deterrent to 
upgrading the software, OIG reviewed the FOIAXpress contract and noted 
that NRC purchased the annual maintenance support package. This 
annual support includes software version upgrades of FOIAXpress at no 
additional cost. 



11 Deduplication eliminates extra copies of data by saving just one copy and replacing the other copies 
with pointers that lead back to the original copy. In its simplest form, deduplication eliminates duplicate 
copies of the same file. 
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Available Technology 

In addition to FOIAXpress, there are other technologies available to assist 
with FOIA processing. According to DOJ FOIA best practices, a key 
aspect of FOIA processing involves searching for records within the 
agency. These searches frequently entail searching through voluminous 
numbers of email messages and disparate records systems throughout 
the organization. Achieving real efficiency in FOIA processing will entail 
agencies maximizing their electronic recordkeeping capacities to facilitate 
identification of the location of records responsive to requests. 

Positive Steps 

While NRC could improve its use of technology to process FOIA requests, 
the agency is doing several things well and has taken steps to increase its 
electronic presence. For example: 

• OIS is in the process of providing regions and certain program 
offices copies of RedactXpress, 12 a software program which would 
allow subject matter experts to redact documents electronically 
rather than manually. 

• NRC offers an extensive array of informational resources on its 
public Web site, including its FOIA Web page. 

• In addition to its Web site, NRC proactively posts thousands of 
records in its publicly available electronic recordkeeping system 
(ADAMS), 13 including records regarding the Fukushima disaster, 
investigation and enforcement actions, reactor regulation, nuclear 
material safety, licensing, environmental safety, nuclear security, 
nuclear research, and agency financial accountability. 



12 RedactXpress is a standalone redaction and declassification software tool used to permanently remove 
sensitive information from electronic documents. It eliminates the manual labor of making copies, tracking 
documents, and filing. 

13 Agencywide Documents Access and Management System. 
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FOIA Training Can Be Improved 

The FOIA training at NRC could be improved. While there is a basic 
online training course and some occasional agencywide live training 
sessions, there are currently no FOIA training requirements for FOIA 
specialists, FOIA coordinators, or agency staff in general. Many of the 
FOIA specialists and FOIA coordinators claimed that their training was 
essentially "on-the-job." 

Several NRC staff expressed frustration with the lack of training for some 
of the FOIA specialists. Some of the issues include: 

• FOIA requests are often far too broad in scope, requiring FOIA 
coordinators to search for "any and all" related to a FOIA request. 
Several coordinators feel that the FOIA office does not do a 
sufficient job of calling requesters and narrowing the scope of their 
requests. 

• Lack of knowledge regarding NRC's processes and program 
offices. 

• Lack of knowledge regarding FOIA law. 

Further, as a possible indicator of a lack of training for NRC staff and FOIA 
coordinators, two external stakeholders who have frequently submitted 
NRC FOIA requests have also been frustrated with certain aspects of 
NRC's FOIA process. Particularly, they were troubled by the inconsistent 
redactions produced by NRC. 

For example, one stakeholder claimed that certain information may be 
redacted in one document of a FOIA request, but the same information will 
appear unredacted in another document of a separate FOIA request. The 
stakeholder questioned why something would be redacted in one 
document but not in another document. He also claimed that he requests 
certain documents on a regular basis and, most times, the documents 
come back with little or no redactions. Yet, the information is never 
publicly posted and he must go through the FOIA process each time for 
future requests. 
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Likewise, the other stakeholder had a similar complaint regarding NRC's 
"nonsensical redactions." He believes NRC is inconsistent with its use of 
security designations to withhold information. He has submitted FOIA 
requests for information that was not publicly available, yet the information 
was sent to him completely unredacted. In his view, the documents 
should have been redacted or they should have already been publicly 
available. NRC's Chief FOIA Officer confirmed that his biggest challenge 
was ensuring that NRC provides a consistent response to FOIA requests. 

The lack of specific training requirements for NRC FOIA personnel is 
noteworthy for several reasons: 

1 . The FOIA office has recently experienced a high amount of 
turnover, losing some seasoned personnel with many years of 
experience. 

2. With the impending FOIA centralization and FOIA coordinator roles 
moving to OIS, the new point-of-contact for each program office will 
likely be the office technical assistant. In NRC's current FOIA 
program, technical assistants typically play little or no role in the 
FOIA process. 

3. FOIA coordinators currently service their own office. After 
centralization, coordinators will be servicing multiple offices, some 
of which they will have little familiarity with. 

4. According to the FOIA.gov public Web site, approximately 74 
percent of NRC's FOIA requests are considered to be complex 
requests, compared to 33 percent for all other Federal agencies. 
Complex requests involve more documents and coordination with 
multiple NRC offices and/or other Federal agencies. 

Lack of Effective Controls 

NRC has not fully used technology or created a training program because 
NRC management has not implemented effective internal controls. 
Specifically, there has been a lack of oversight and communication with 
regard to technology issues, and there is no clear written guidance or 
policy on training. 
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Lack of Oversight and Communication Regarding FOIAXpress 

FOIAXpress has not been upgraded to its current version due to a lack of 
management oversight and communication. The initial upgrade request 
from Version 7 to Version 8 was sent to OIS by the FOIA office on June 
25, 2013, yet the actual upgrade did not occur until March 28, 2014. The 
primary issue that stalled the upgrade was a technical problem in getting 
Version 8 to work with one of NRC's existing servers. When FOIA office 
staff were questioned about this, the consensus among the FOIA staff was 
that they did not understand the technical aspects of the issue and were 
relying on OIS to fix the problem. 

OIG followed up on this issue in interviews with several staff and 
management in OIS. After interviews with the Deputy Director of OIS and 
the Chief Information Officer, FOIAXpress was upgraded to Version 8 - 
approximately 9 months after the FOIA office's initial request. Still, 
Version 8 is not the most current version of FOIAXpress. 

During the course of these interviews, it became clear that there was no 
ownership of the overall process to upgrade the FOIAXpress software. 
Most of those interviewed could not answer questions about where the 
breakdown was occurring or who was responsible for overseeing it. It was 
readily apparent that there was no communication to or from the FOIA 
office and OIS senior management, while the situation lingered without 
being adequately addressed. 

No Written Training Guidance or Program 

Currently, there are no formal training requirements for FOIA specialists 
and coordinators because there is no written training guidance or training 
program. With FOIA centralization soon approaching, the FOIA office has 
written a training plan that is currently in draft mode. In the 2014 Chief 
FOIA Officer Report to DOJ, NRC asserts it is "expanding existing 
substantive FOIA training based on best-practice FOIA procedures, scope 
of exemptions and exclusions, and up-to-date legal developments in 
tandem with FOIA centralization. This will be required for all FOIA 
professionals and available to all program office staff." 
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Two NRC training officials were interviewed and they stated that requiring 
all agency staff to take FOIA training would likely be difficult to implement. 
There is also the question of cost-benefit as making training mandatory for 
all NRC staff has a significant cost associated with it. While providing 
FOIA training for all NRC staff would be ideal, it is not practical because of 
budgetary constraints and only underscores the importance of having 
proper training for FOIA office personnel so they can properly guide and 
assist NRC staff. 



Higher Costs and Reduced Timeliness 



NRC has encountered high FOIA processing costs and has not been 
meeting the statutory 30-day limit to process complex FOIA requests. As 
mentioned earlier in the report, approximately 74 percent of NRC's FOIA 
requests are considered by the agency to be complex. This also is a 
factor in NRC's high processing costs and lack of timeliness. See Figure 
2 for a breakdown of requests processed. 14 

Figure 2: 

NRC's FY13 FOIA Requests Processed 




■ Simple 

■ Complex 

■ Expedited 



Source: OIG 



14 Expedited requests are FOIA requests placed at the front of the processing queue where the requester 
clearly demonstrates a compelling need because (1) the failure to obtain requested records on an 
expedited basis could reasonably be expected to pose an imminent threat to the life or physical safety of 
an individual or (2) with respect to a person primarily engaged in disseminating information, there is an 
urgency to inform the public concerning actual or alleged Federal Government activity. 
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NRC's cost per FOIA request processed is significantly higher than other 
agencies. NRC spent approximately $7,225 per FOIA request processed 
in FY 201 3. 15 The average cost per request processed for the other 98 
Federal agencies was about $615. Other agencies subject to FOIA only 
consider approximately 33 percent of the requests received complex. This 
certainly played a significant factor in the disparity between FOIA 
processing costs, but the fact remains that NRC's cost per request 
processed still is extremely high. 16 

NRC is also not meeting its statutory 30-day timeliness requirement for 
processing complex FOIA requests. (See Figure 3 for NRC average 
processing times.) 

Figure 3: 

NRC's FY13 Average Processing Time 



■ Simple 

■ All Requests 

■ Complex 



7 



Source: OIG 




15 NRC spent approximately $2.67 million in processing 370 FOIA requests. Data for these calculations 
was obtained from the FOIA.gov public Web site. 

16 To help offset the imbalance of NRC's complex requests compared to other Federal agencies; OIG 
also analyzed the cost per FOIA request by removing the Japan team's FOIA requests. While only a 
rough estimate, the cost per FOIA request dropped to approximately $5,000 - still a large number in 
relation to all other Federal agencies. 
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Recommendations: 

OIG recommends that the Executive Director for Operations: 

1. Implement technology, such as RedactXpress, in the regions and 
larger program offices to more efficiently process FOIA requests. 

2. Conduct annual reviews to determine the feasibility of upgrading 
technology within OIS to more efficiently process FOIA requests. 

3. Develop a process to ensure that the FOIA office's information 
technology needs are met in a timely manner, specifically with 
regard to FOIAXpress updates. 

4. Develop and implement an OCHCO and DOJ-approved formal 
training and development program for all FOIA office personnel. 

5. Obtain DOJ FOIA e-learning training modules and encourage all 
agency staff to pursue completion through annual agency 
communications. 

6. Reintroduce FOIA branch led training for NRC staff on an annual 
basis. 

7. Conduct a review of FOIA requests to determine if frequently 
requested non-public documents can be proactively placed into 
public ADAMS for future use. 
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B. Management Level Reviews Are Inconsistent 

NRC is not in compliance with FOIA regulations as initial disclosure 
reviews of FOIA records are done at inconsistent management levels. 
Federal regulations state that, during the initial disclosure review, the head 
of the responsible office must review agency records to determine whether 
the agency records are exempt from disclosure; however, there is no 
enforcement of this policy and there is no method to track these reviews. 
Additionally, NRC's internal guidance differs from the Code of Federal 
Regulations. This may result in (A) a reduced number of discretionary 
releases 17 or (B) the inadvertent release of sensitive information. 

Review and Approval Required 

The Code of Federal Regulations requires that, during the initial disclosure 
review, the head of the responsible office shall review agency records to 
determine whether the agency records are exempt from disclosure. 18 If 
the head of the office determines that, although exempt, the disclosure of 
the agency records will not be contrary to the public interest and will not 
affect the rights of any person, the head of the office may authorize 
disclosure of the agency records. 

Additionally, Attorney General Holder's memo states: 

An agency should not withhold information simply because it may 
do so legally. I strongly encourage agencies to make discretionary 
disclosures of information. An agency should not withhold records 
merely because it can demonstrate, as a technical matter, that the 
records fall within the scope of a FOIA exemption. 



17 A discretionary disclosure, or discretionary release, is the approved release of information that falls 
under one of the FOIA exemptions. This information may be released because it poses no perceived 
harm to the agency or individuals involved. 

18 10 CFR 9.25(f) . However, the Commission, Office of the Secretary, Office of the Inspector General, 
and Office of General Counsel are subject to unique disclosure review requirements. See 10 CFR 
9.25(g) for specific details. 
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NRC Not in Compliance with FOIA Regulations 

NRC is not in compliance with FOIA regulations as initial disclosure 
reviews are not consistently conducted by office directors. OIG contacted 
19 FOIA coordinators from the program offices and 4 coordinators from 
the regional offices inquiring about office director review of FOIA records. 
While all four of the regions involve senior management at a branch chief 
level or above in FOIA records reviews, approximately half of the program 
offices surveyed revealed that no senior management reviewed their FOIA 
records. 

According to FOIA office staff, a cover memo describing the contents of 
the FOIA records usually accompanied the records submitted to the FOIA 
office. It was common for FOIA coordinators to sign these cover memos 
without a signature from their senior management. The staffer said that 
the FOIA office will sometimes process FOIA records without any 
confirmation that program office senior management reviewed the 
records. Furthermore, if the FOIA records were emailed from a program 
office to the FOIA office, there may be no cover memo at all. Another 
person in the FOIA office stated that, as a practice, office directors rarely 
review FOIA responses coming to the FOIA office. 

Lack of Internal Controls 

NRC's initial disclosure reviews are inconsistent because there is a lack of 
effective controls. For instance: 

• The use of the current cover memo is not enforced and it does not 
contain an area for senior management signoff. 

• There is a disconnect between the Code of Federal Regulations 
and NRC's primary internal FOIA guidance, Management Directive 
3.1. 

Management Directive 3.1 states: 

When information that is believed to be exempt from disclosure has 
been identified and bracketed, the director or a management official 
at the Grade 15 level or higher in the responsible office will review 
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the records, or portions thereof, proposed to be withheld and further 
determine whether disclosure of the exempt information will 
adversely affect the public interest or the rights of any person. 

However, the Code of Federal Regulations specifies only the office 
director; it does not provide the option of a management official at Grade 
15 level or higher to conduct the initial disclosure review. 

While the four regional offices and roughly half of the program offices 
obtained senior management approval of FOIA packages, very few, if any, 
received approvals from the office director. The majority of these offices 
followed the guidance in Management Directive 3.1, not the Code of 
Federal Regulations. Despite the fact that office director review is in the 
Code of Federal Regulations, and a more flexible version is in 
Management Directive 3.1, neither policy is uniformly enforced by NRC 
management. 

Potential for Releases 

Without senior management initial disclosure review of FOIA records, 
there is the potential that (A) discretionary releases may not occur or (B) 
sensitive information could be inadvertently released. According to 
regulations, agency staff cannot release exemption-qualified information - 
this falls directly on the head of the office. Therefore, if the office director 
is not reviewing the FOIA record, the likelihood of overriding a subject 
matter expert's withholdings and making a discretionary release would 
significantly decrease. 

On the other hand, if an office director or senior management official does 
not review a FOIA record, there is also the potential that sensitive 
information could be released. The FOIA coordinator and FOIA office may 
not have the expertise to sufficiently review the entire FOIA record, while 
the Office of the General Counsel generally reviews only redactions within 
FOIA records. If the subject matter expert elects not to make redactions in 
a FOIA record, then that information may be released without any further 
scrutiny. 
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Recommendations: 

OIG recommends that the Executive Director for Operations: 

8. Develop and implement a process to confirm appropriate program 
and regional office management review of FOIA records. 

9. Either revise Management Directive 3.1 to comply with the 
disclosure review requirements found in 10 CFR Part 9.25(f) or 
revise 10 CFR Part 9.25(f) to allow office heads the authority to 
delegate the initial disclosure review determination responsibility to 
a designee at a managerial Grade 15 level or above. 
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IV. CHALLENGES 



NRC's upcoming plan to centralize most FOIA coordinator positions into 
OIS presents several challenges for the agency. During interviews with 
staff, OIG found there is resistance to the upcoming centralization. FOIA 
specialists, FOIA coordinators, and an NRC manager all expressed 
concerns. Many staff interviewed believe that centralization will make the 
FOIA process less efficient by adding additional unintended steps and 
removing the expertise from the offices. Some of the concerns expressed 
to OIG by staff regarding centralization are: 

• Centralization will just be "an extra layer to the process." 

• The FOIA process was set up in a decentralized way years ago 
(i.e., a coordinator in each office) because you want expertise in the 
office. 

• There will be additional back and forth between offices and there 
could also be individuals in the program offices that have no 
experience processing FOIA requests. 

Communication 

Communication is the most significant challenge associated with 
centralization. Relevant, reliable, and timely communication is required to 
control operations and achieve objectives. Recently, OIG found an overall 
lack of effective communication within OIS during an Audit of NRC's 
Information Technology Governance.™ In light of this finding and staff's 
resistance to centralization, management's involvement and commitment 
to communication is essential. NRC management must communicate its 
vision of how a centralized FOIA office will function. In order to achieve 
buy-in, management should involve as many people as possible, 
communicate the essentials, and communicate frequently to respond to 
staff's needs. 



This report ( OIG-14-A-04 ) is publicly available in ADAMS; see accession number ML13343A244. 
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OIS management confirmed that communication is a challenge and is 
taking steps to address this. Management explained that the information 
technology coordinator centralization (also part of the agencywide initiative 
to reduce duplication of efforts) is going well and that they are applying the 
same model towards the FOIA centralization. Focus groups from program 
offices have been established to discuss issues with the FOIA process. 
Additionally, weekly centralization meetings were held with FOIA staff to 
solicit feedback. 

Guidance 

Ensuring that FOIA guidance documents are up to date is another 
challenge associated with centralization. Centralization will cause 
processes and procedures to change. Federal standards require clearly 
documenting processes at an appropriate level of detail to allow 
management to effectively monitor the activity. Guidance must be 
properly managed, maintained, and made available in order to meet its 
intended purpose. Management must plan to update or revise procedures 
with any changes resulting from centralization. Well-designed guidance 
documents, if used properly, can appropriately direct agency employees 
and increase efficiency. 

Monitoring 

Another challenge will be to determine if the centralization of FOIA staff is 
achieving the desired outcomes. Once centralization is complete, 
management should monitor performance measures and indicators to 
determine if the new centralized structure is performing as intended. A 
best practice would also be to conduct a self-assessment of the FOIA 
program after the centralization is complete. Management can then use 
the results of these efforts to modify any processes found to have 
weaknesses. 
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V. CONSOLIDATED LIST OF RECOMMENDATIONS 



OIG recommends that the Executive Director for Operations: 

1. Implement technology, such as RedactXpress, in the regions and 
larger program offices to more efficiently process FOIA requests. 

2. Conduct annual reviews to determine the feasibility of upgrading 
technology within OIS to more efficiently process FOIA requests. 

3. Develop a process to ensure that the FOIA office's information 
technology needs are met in a timely manner, specifically with 
regard to FOIAXpress updates. 

4. Develop and implement an OCHCO and DOJ-approved formal 
training and development program for all FOIA office personnel. 

5. Obtain DOJ FOIA e-learning training modules and encourage all 
agency staff to pursue completion through annual agency 
communications. 

6. Reintroduce FOIA branch led training for NRC staff on an annual 
basis. 

7. Conduct a review of FOIA requests to determine if frequently 
requested non-public documents can be proactively placed into 
public ADAMS for future use. 

8. Develop and implement a process to confirm appropriate program 
and regional office management review of FOIA records. 

9. Either revise Management Directive 3.1 to comply with the 
disclosure review requirements found in 10 CFR Part 9.25(f) or 
revise 10 CFR Part 9.25(f) to allow office heads the authority to 
delegate the initial disclosure review determination responsibility to 
a designee at a managerial Grade 15 level or above. 
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VI. AGENCY COMMENTS 



An exit conference was held with the agency on June 1 1 , 2014. Prior to 
this meeting, after reviewing a discussion draft, agency management 
provided supplemental information that has been incorporated into this 
report, as appropriate. As a result, agency management stated their 
general agreement with the findings and recommendations in this report 
and opted not to provide formal comments for inclusion in this report. 
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Appendix A 

OBJECTIVE, SCOPE, AND METHODOLOGY 



Objective 

The audit objective was to determine whether the FOIA process is efficient 
and complies with the current laws. 

Scope 

The audit reviewed NRC's activities related to FOIA with special emphasis 
on process and compliance with current laws. This audit did not review 
FOIA activities associated with the Japan FOIA efforts. OIG conducted 
this performance audit from November 2013 through April 2014 at NRC 
headquarters in Rockville, Maryland. Internal controls related to the audit 
objective were reviewed and analyzed. Throughout the audit, auditors 
were aware of the possibility or existence of fraud, waste, and abuse in 
the program. 

Methodology 

To address the audit objective, OIG auditors interviewed 65 individuals. 
These interviews included NRC management and staff at headquarters 
and staff at each of NRC's four regional offices. Regional office interviews 
were conducted by telephone. The interviews also included stakeholders 
and management from the Office of Information Policy at the Department 
of Justice. Furthermore, OIG reviewed Federal and internal agency 
guidance, including: 

• Freedom of Information Act (5 U.S.C. § 552). 

• 1 0 CFR Part 9, Subpart A, Freedom of Information Act Regulations. 

• NRC Management Directive 3.53, NRC Records and Document 
Management Program. 

• Executive Order 13392 of December 14, 2005, Improving Agency 
Disclosure of Information. 
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• 2009 Presidential Memorandum for the Heads of Executive 
Departments and Agencies. 

• Attorney General Memorandum for the Heads of Executive 
Departments and Agencies. 

• Second Open Government National Action Plan for the United 
States of America. 



OIG auditors observed a walkthrough of the FOIA process and assessed 
the technological tools used for FOIA processing. Furthermore, OIG 
conducted a review and analysis of FOIA: 



• Timeliness statistics. 

• Training requirements. 

• Processing costs. 

• Approvals. 

• Dispositions. 

• Repetitive requests. 



We conducted this performance audit in accordance with generally 
accepted Government auditing standards. Those standards require that 
we plan and perform the audit to obtain sufficient, appropriate evidence to 
provide a reasonable basis for our findings and conclusions based on our 
audit objectives. We believe that the evidence obtained provides a 
reasonable basis for our findings and conclusions based on our audit 
objectives. 

The audit was conducted by Beth Serepca, Team Leader; 
Robert Woodward, Audit Manager; Michael Blair, Senior Analyst; 
Jenny Cheung, Auditor; and Regina Revinzon, Student Analyst. 
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Appendix B 

FOIA Exemptions 



Exemption 
number 


Matters that are exempt from FOIA 


(1) 


(A) Specifically authorized under criteria established by an Executive Order to be kept 
secret in the interest of national defense or foreign policy and (B) are in fact properly 
classified pursuant to the Executive Order. 


(2) 


Related solely to the internal personnel rules and practices of an agency. 


(3) 


Specifically exempted from disclosure by statute (other than section 552b of this title), 
provided that such statute (A) requires that matters be withheld from the public in such 
a manner as to leave no discretion on the issue or (B) establishes particular criteria for 
withholding or refers to particular types of matters to be withheld. 


(4) 


Trade secrets and commercial or financial information obtained from a person and 
privileged or confidential. 


(=>) 


Interagency or intra-agency memorandums or letters that would not be available by 
law to a party other than an agency in litigation with the agency. 


(o) 


Personnel and medical files and similar files the disclosure of which would constitute a 
clearly unwarranted invasion of personal privacy. 


(7) 


Records or information compiled for law enforcement purposes, but only to the extent 
that the production of such law enforcement records or information: 


(A) 


could reasonably be expected to interfere with enforcement proceedings; 


(B) 


would deprive a person of a right to a fair trial or impartial adjudication; 


(C) 


could reasonably be expected to constitute an unwarranted invasion of personal 
privacy; 


(D) 


could reasonably be expected to disclose the identity of a confidential source, including 
a state, local, or foreign agency or authority or any private institution which furnished 
information on a confidential basis, and, in the case of a record or information compiled 
by a criminal law enforcement authority in the course of a criminal investigation or by 
an agency conducting a lawful national security intelligence investigation, information 
furnished by confidential source; 


(E) 


would disclose techniques and procedures for law enforcement investigations or 
prosecutions, or would disclose guidelines for law enforcement investigations or 
prosecutions if such disclosure could reasonably be expected to risk circumvention of 
the law; or 


(F) 


could reasonably be expected to endanger the life or physical safety of an individual. 


(8) 


Contained in or related to examination, operating, or condition of reports prepared by, 
on behalf of, or for the use of an agency responsible for the regulation of supervision of 
financial institutions. 


(9) 


Geological and geophysical information and data, including maps, concerning wells. 
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